Loading story…
CVE-2026-23800 is a critical (CVSS 10.0) CWE-266 Incorrect Privilege Assignment vulnerability in Modular DS’s modular-connector component affecting versions 2.5.2 up to (but not including) 2.6.0. The issue is described as enabling remote privilege escalation with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N, with scope change), with potential for full impact to confidentiality, integrity, and availability. Public tracking pages also reference external records (e.g., NVD) and third-party writeups (e.g., Patchstack) for additional context and remediation guidance.
Threat-intelligence commentary notes that, despite the severity and apparent ease of exploitation, no public exploits were reported as available at the time of disclosure, increasing the importance of rapid patching/upgrade planning and monitoring for exploitation attempts. Other items in the provided material—such as a Rapid7 Metasploit weekly wrap-up covering unrelated modules and a separate Android-related information disclosure CVE—do not describe this Modular DS vulnerability and should not be treated as part of the same incident narrative.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A critical vulnerability tracked as CVE-2026-23800, described as an incorrect privilege assignment issue (CWE-266) in Modular DS, is publicly listed by security tracking sources. The references do not provide additional details such as exploitation, vendor response, or patch availability.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **critical unauthenticated privilege-escalation vulnerability** in the *Modular DS* WordPress plugin is being **actively exploited in the wild** to obtain administrator access. The flaw, tracked as **CVE-2026-23550** (CVSS **10.0**), affects *all versions up to and including 2.5.1* and is fixed in **2.5.2**; the plugin is reported to have **40,000+ active installs**. The issue stems from the plugin’s routing/authentication design under the ` /api/modular-connector/ ` prefix, where attackers can bypass authentication middleware by forcing “direct request” handling using parameters such as `origin=mo` and an arbitrary `type` value, particularly when the site is already connected to Modular services (i.e., tokens are present/renewable). Exploitation leverages exposed routes including ` /login/ ` (notably ` /api/modular-connector/login/ ` / ` /login/{modular_request} `), enabling auto-login behavior that results in **administrator-level access** and potential full site compromise (e.g., data access, backups, management actions, and follow-on malware/persistence). Reporting also notes observed attacker behavior and indicators tied to exploitation attempts against the login endpoint (e.g., requests containing `origin=mo&type=foo`) and lists IPs associated with scanning and post-exploitation activity, including `45.11.89[.]19`, `162.158.123[.]41`, `172.70.176[.]95`, and `172.70.176[.]52`. Patch guidance emphasizes immediate upgrade to **2.5.2**, and mitigations include rules intended to block exploit patterns and hardening changes such as stricter route binding and `type` validation.
Jun 29, 2026
Public disclosures highlighted multiple high-severity vulnerabilities across industrial control systems, open-source software, and consumer networking gear, with several issues enabling **unauthenticated remote compromise**. Johnson Controls disclosed **CVE-2025-26385** (CVSS 10.0), a critical SQL injection affecting multiple building/ICS management products (including *ADS/ADX, LCS8500, NAE8500, SCT, CCT*) that can allow remote, unauthenticated attackers to execute arbitrary SQL to alter/delete/exfiltrate data; CISA guidance emphasized isolating control system networks from the internet, segmentation, and controlled remote access (e.g., VPNs). Additional unauthenticated remote issues include **CVE-2026-25069** in *SunFounder Pironman Dashboard* (path traversal in log API endpoints enabling arbitrary file read/deletion) and **CVE-2025-51958** in the *DokuWiki* `runcommand` plugin (unauthenticated command execution via `lib/plugins/runcommand/postaction.php`). Other disclosures include developer-tooling and application-layer injection flaws and multiple router memory-corruption bugs with public exploit references. *Orval* fixed **CVE-2026-25141**, a code-injection issue where incomplete escaping can be bypassed using **JSFuck**-style payloads, and *Cybersecurity AI (CAI)* addressed **CVE-2026-25130**, where `subprocess.Popen(..., shell=True)` enables argument/command injection leading to RCE (notably via the `find_file()` tool). Data-layer issues include **CVE-2025-69662** in *geopandas* (`to_postgis()` SQL injection) and **CVE-2026-24854** in *ChurchCRM* (authenticated SQL injection via `PerID` in `/PaddleNumEditor.php`, patched in 6.7.2), while **CVE-2025-36384** affects *IBM Db2 for Windows* (local privilege escalation via unquoted search path). SOHO router flaws **CVE-2026-1686** (*Totolink A3600R*) and **CVE-2026-1637** (*Tenda AC21*) describe remotely reachable buffer/stack overflows with publicly available exploit material, increasing the likelihood of opportunistic exploitation where exposed management interfaces exist.
Jun 29, 2026
A critical vulnerability in the MajorDoMo home automation platform, tracked as **`CVE-2026-27174`**, allows unauthenticated remote code execution on internet-facing servers. The flaw stems from improper authentication handling in **`/admin.php`**, where requests continue to be processed after a redirect, combined with unsafe use of PHP **`eval()`** on attacker-controlled input in an internal AJAX console/debugging component. Researchers reported that a single crafted HTTP GET request can reach the internal handler and execute arbitrary PHP code without valid credentials. Successful exploitation can give attackers full server compromise, including the ability to run system commands, read sensitive files, steal credentials, and deploy persistent web shells. Because MajorDoMo is often used to manage cameras, sensors, locks, and other building or home automation systems, a breach can also expose connected IoT environments and support lateral movement into internal networks. Public detection content, including a **Nuclei** template, is already available, raising the risk of rapid exploitation, and defenders have been urged to apply the vendor patch, restrict admin access to trusted networks, place the interface behind a VPN or authenticated reverse proxy, disable the console feature where possible, audit logs, and rotate secrets.
Jun 29, 2026